Ranzy

Ranzy Locker is a ransomware operation active since late 2020 that is widely described as a rebranded and improved successor to ThunderX, with infrastructure overlap also noted with Ako. The group operated a ransomware-as-a-service model and used double extortion, stealing sensitive data before encrypting victim systems and threatening public release to coerce payment. Victims were reported across manufacturing, government, transportation, and information technology, and U.S. businesses were prominently affected, with more than 30 compromises reported by mid-2021. Ranzy Locker obtained access through multiple vectors, including exploitation of Microsoft Exchange Server vulnerabilities, phishing, Remote Desktop Protocol access using valid accounts, and brute-force activity. Post-compromise behavior included discovery of mounted drives, network shares, remote systems, running processes, and attached media, as well as searching for high-value data for exfiltration such as customer information, personally identifiable information, and financial records. The malware and associated operator activity also included anti-debugging checks, configuration obfuscation, deletion of backups and shadow copies, and disabling of Windows recovery features to hinder restoration. For impact, Ranzy Locker encrypted files using Salsa20, with per-file key protection via RSA-2048, and deployed ransom notes directing victims to attacker-controlled payment communications. The operation is associated with leak-site activity and affiliate-based deployment consistent with big-game ransomware practices.